This policy explains what personal data [legal.entity — to be completed] ("KwikQA", "we") collects when you use the KwikQA command-line tool, website, and hosted service, and what you can do about it.
Who we are
[legal.entity — to be completed], [legal.address — to be completed], is responsible for the personal data described here. Contact us about privacy at privacy@kwikqa.com.
What we collect
Account
When you sign in with GitHub, we receive and store your GitHub numeric id and username. Your profile picture is loaded from GitHub using that id. We don't store your email address, we get no access to your repositories, and we don't store the GitHub token.
Plan and billing
We store your plan and the identifiers Stripe gives your customer record and subscription. Stripe collects your name, email address, billing address, and payment details to process payments, under its own privacy policy. We don't receive your card details.
Usage
For each AI request made through the hosted service, we store when it happened, its kind (diagnosis or repair), the model and provider, whether it succeeded, whether it counted toward your plan, token counts, its cost to us, and a SHA-256 hash of the request. We also keep monthly usage counters.
Tokens and sessions
We store hashes of your CLI and CI tokens and website sessions, the names you give tokens, and when each was created and last used.
Cookies
The website sets two cookies, both strictly necessary: a session cookie that keeps you signed in (30 days) and a short-lived cookie that protects the GitHub sign-in step (10 minutes). We don't use analytics or advertising cookies.
Service logs
Our hosting provider, Cloudflare, processes IP addresses and request details to deliver and protect the service. Our own error logs record the request method and path, not your data.
What we don't collect
On the Free, Pro, and Max plans, the redacted evidence packet you approve passes through our service to OpenRouter and is not stored. We never store your source code, your evidence packets, or the model's answers. On the bring-your-own-key plan, evidence goes from your machine directly to OpenRouter and never reaches us. Run records, patches, and validation output stay on your machine.
Evidence sent to AI providers
When you approve a request on a hosted plan, we forward the redacted packet to OpenRouter, which sends it to the model provider named in the preview (Anthropic for diagnoses and OpenAI for repair proposals). They process it to produce the answer, under their own terms and data policies. KwikQA removes secrets and sensitive fields before you approve, but you decide what you send. See Security for what a packet contains.
How we use it
- to provide the service: sign-in, plans, usage limits, and forwarding requests you approve;
- to bill you and keep billing records;
- to keep the service secure and prevent abuse;
- to answer support requests; and
- to monitor the service's costs in aggregate.
We don't sell personal data, use it for advertising, or use your data to train AI models.
Legal bases
Where the GDPR or UK GDPR applies, we process account, usage, and billing data to perform our contract with you, security and cost-monitoring data for our legitimate interest in running a reliable and affordable service, and billing records to meet legal obligations.
Who we share it with
| Provider | Purpose |
|---|---|
| Cloudflare | Hosting, database, and network protection |
| OpenRouter, Anthropic, OpenAI | Producing diagnoses and repair proposals you approve |
| Stripe | Payments, invoices, and the billing portal |
| GitHub | Sign-in |
We also disclose data when the law requires it, and to a successor if the business is transferred, under this policy.
International transfers
These providers may process data in the United States and other countries. Where the law requires it, transfers rely on safeguards such as the European Commission's standard contractual clauses.
How long we keep it
| Data | Kept |
|---|---|
| Account and plan | Until you delete your account |
| Request records and monthly usage counters | 13 months |
| Website sessions | 30 days |
| Revoked tokens | 90 days after revocation |
| Free-retry tickets | 90 days |
| Billing records held by Stripe | As long as tax and accounting law requires |
Your choices and rights
- Export: download everything we store about your account from Account.
- Delete: delete your account from the same page. This cancels any subscription and removes your records immediately.
- Correct: your username updates each time you sign in.
- Other rights: depending on where you live, you may also object to or restrict processing, or complain to a data protection authority. Email privacy@kwikqa.com.
Children
KwikQA is not intended for anyone under 16, and we don't knowingly collect their data.
Changes
We'll post any changes here and update the effective date. For material changes, we'll also tell you in the dashboard or by email where we have your address.